Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-76086Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

High 8.5

In plain English

A high-severity missing authorization in formie from verbb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistverbb/formie3.1.31GHSA-v3f3-cmj4-cvj9
Packagistverbb/formie2.2.23GHSA-v3f3-cmj4-cvj9

Affected products (as reported)

VendorProductVersions
verbb formie < 2.2.23>= 3.0.0, < 3.1.31

Weakness: CWE-862, CWE-915, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References